Advanced persistent threat groups are launching extensive attacks on national critical institutions and key infrastructures. Learning contextual information among entities using graph neural network models based on provenance graphs has demonstrated excellent performance in threat detection. However, due to constraints of transmission costs and privacy concerns, existing threat detection methods typically rely solely on audit logs within their own domains, which contain only part of the attacker's behavior. Attackers have also recognized this, so they brazenly carry out attack attempts and expand their impact. The information asymmetry across multiple domains indeed significantly impacts the efficiency and timeliness of APT detection. This paper introduces a novel cross-domain threat detection (CDTD) scheme based on collaborative graph learning for effective and early APT detection. The core idea of CDTD is to foster mutual benefits by utilizing potential cross-domain general knowledge from heterogeneous data and collaborating on precious threat intelligence, which could mitigate information asymmetry. Experimental results demonstrate that the proposed method achieves state-of-the-art detection capabilities and reduces the workload of security analysts. Additionally, the distributed detection scheme significantly decreases system overheads in terms of network bandwidth, memory usage, and execution time, which shows promising potential for broad applications of the proposed scheme.

The progress of location-based services has led to severe concerns about location privacy leakage. However, existing methods are still incompetent for efficient and scalable location privacy preservation (LPP). They are often vulnerable to inference attacks with side information, or hard to be implemented due to the high computational complexity. In this paper, we pursue the high protection quality with low computational complexity. We propose ascalableLPP method based on the paradigm of counterfeiting locations. To make fake locations extremely plausible, we forge them by synthesizingartificial impostors. The so-called artificial impostors refer to the synthesized traces that have similar semantic features to the actual traces, e.g., similar transition patterns, and do not contain anyprotected location, i.e., the exact location that needs to be protected. We devise two dedicated techniques: thestation-based synthesis methodand thepopulation-level semantic model. We conduct the experiments on real datasets of two cities (Shanghai of China and Asturias of Spain) to validate the quality of privacy preservation, utility loss, and scalability of the proposed method. Based on these two datasets, the experimental results show that our method achieves the privacy preservation quality of$97.68\%$and$96.24\%$, respectively, and the time spent on building generators is only 144.96 seconds and 136.08 seconds, respectively. The experimental results also show that our method achieves a good trade-off between privacy and utility. Our study would give the research community new insights into improving the practicality of LPP paradigm via counterfeiting locations.